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This action requests your con- 
currence on a letter for the 

DCI's signature, requesting the 
Secretary of Conmerce delegate 
his authority to waive Federal 
Information Processing Standards 
(FIPS) to the DCI or the DCI's 
designee. FIPS are promulgated 
by law and executive order by 
the National Bureau of Standards. 
There are about 80 standards, 
pertaining to hardware, software 
and data. TO waive a standard 
to procure non-conforming disk 
equipment, for example, an 
agency head must obtain the 
approved, of the Secretary of 
Conmerce. The FIPS waiver pro- 
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:O>'0KAKDUM FOE : 


Director of Central Intelligence 


VIA : 


•RCR 


Deputy Director for Administration 


General Counsel 

Director of Logistics ''■”‘'[‘■.,1 

Director of Security 


8 z uce T . Joh n & on 

Director of Data Processing 



(^ v /70' cP 


fc.UDJf.CT: Federal Information Process i no Standards (FIPS) 

PLFERLLCL: Letter frors the Dl;A , Fr. Don fcortman, to the 

Assistant Secretary for Productivity, Technology 
and Innovation, Department of Commerce, 

Lr. Jordan d. Baruch, did. ^ November 15fif 


1. Ac t i cn requested : Paragraph 6 is a re commend a t ion 
that you s ign ‘ the attached letter to the Secretary of Commerce 
requesting that independent authority to waive. Federal 

In forme t ion Processing Standards (FIPS) be delegated to you or 
your designee. 

2. background : Federal Information Processing Standards 
(FIPD) are promulgated by the Department of Commerce under the 
provisions of Public Lav, 09-306 (the Brooks Act) and Part 6 of 
Title 15 Code of Federal Regulations. These standards art 
prescribed for Federal agencies in the acquisition, development, 
and use of automatic data processing (ADP) systems and in the 
interchange of data between and among agencies and with the 
public. The use- cf such standards, which are adopted after 
review by Federal agencies, industry, and the public, is intended 
tc reduce Government costs and improve the effectiveness of a dp 
services, we are supportive of a well-managed Federal ADR 
standards program, however, the unique nature of intelligence, 
wit}) its concomitant security concerns, causes us special 
problems with respect to the open procedures surround! no the fip:- 
pregrar. 
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SUBJECT ; 


Federal Inf erne t ion Processing Standards. (FIPS) 


3. Each FIPS standard has associated with it a waiver 
procedure, whereby , if adverse economic or operational impact can 
foe demonstrated, an agency may utilise equipment or software that 
does not conform to the standard. Authority to waive these 
standards resides, depending on the standard, with the Department 
of Commerce or the agency head . (Even those standard*; where the 
waiver authority resides with the agency head still require 
"coordination in advance* with the. be par tir.cn t. ) Heretofore, we 
have not made any formal waiver reoucsts. As the standards 
program has become sicre active and increased in scope, we find 
that full conformance with existing standards is not, in our 
judgment, in tie Agency's interest. In the future, wc will 
require occasional waivers and, therefore, we are concerned about 
the security implications of PIPE waiver procedures, these 
procedures generally will require* sensitive information on Agency 
A DP systems be shared with the Department of Commerce. he have 
described our security concerns in more detail in the attached 
letter to the Secretary of Commerce. 

4. Our concern with the FIPS waiver procedures is not 
hypothetical. For example, we have a near-term problem with FIPS 
60-63, which deal with input/cutput interface standards and would 
deny us use of some new mass storage (disk drive) technology 
vital to our A DP programs. h'e believe we have a strong case for 
a waiver from FIFE 60-6-3. however, the existing waiver 
procedures for FIPS 60-63 require approval of the waiver request 
by the Secretary of Commerce . he ere reluctant to make cur case 
through these existing procedures because of the precedent it 
sets and the security imp-1 icat ions of having another department 
in cur A DP procurement process. Again, our concern is with all 
FIPS and not just PIPE 60-62. 

5 . The Secretary of Commerce, under the previous 
administration, delegated certain FIPS authority to the former 
Assistant Secretary for Productivity, Technology and Innovation, 
Dr. Jordan J. Baruch.. On 5 November 1 S E C , our former Deputy 
Director for Administration, Don hcrtiaan, sent a letter to 

Dr. Baruch requesting e general delegation of FTPS waiver 
authority to the DCI. The letter (reference) outlined our 
security rationale for requesting such & delegation. Three 
months have elapsed and we have had no formal response. The 
informal response is that Commerce is taking action tc delegate 1 
waiver authority, pertaining specifically to FIPS 60-63, to the 1 
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;ur.:u : c 


federal In format inn Processing Standards {FIPS) 


heeds of all agencies. We welcome this move, but unfortunately 
it will not be t ire ly enough for our immediate procurement 
needs. Such a delegation will require a minimum of three and 
more realistically six months tc implement and even then it will 
address only PIPE 6C-*3, not other current or future PIPE. A 
timely response from the Secretary of Commerce tc the attached 
waiver delegation request would overcome these drawbacks. 

t. Recommendation ; We recommend the t you send the attached 
letter to the Secretary of Commerce reiterating our previous 
unanswered request for a delegation of independent authority to 
you or your designee to grant waivers to Federal Information 
Processing S tandard s (FI PS ) . 


/s / craca *• 
Bruce 'i. 


-.an 


Johnson 


Attachment: 
Letter to the 


Sc c re t o ry c f Comswc rc e 
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Federal Information Processing Standards- { F IPS) 


CONCUR. : 


/*, / '77ia^ MageJL 

Del' u ty ’’Director ' T o r "Adman US’ t r a ticn 


~~TiaFe~" 


J7 


/s/ Daniel B. Silver 

Senera’l' Counsel 


MAR 4 1981 

I5ate 


/s/ Jar-, a H. McDonald 

Director of Loaistlcs 


/e 

1 !TrTc tor"“o f'' TeclTr Tty 

A PPL 0 VP P: 


. iggi 
Date 


jyjMK ' d - 

r.-a t< 


/s/ W ilitem ij * Cssfsy 



Director ~o£~Centrer fntcTiTcencc 


Date 


CDP/XS/WHJ jelJ 


prebruary 1981 ) 
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DC I* u/atts. 

Cl-C I. , v/atte. 

Executive Registry# w/atts. 

Deputy Director for Administration, 
General Counsel, v/atts. 

Director of Logic tics, w/atts. 
Director of Security, w/atts. 

P/CPP 

D'T-P/bb 

CLP Registry 


w/atts . 
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The Honorable Tfeleolta Baldridge 
The Secretary of Comae roe 
1 4 1 h and Con st i t u t i on Avenu e 
Wa s i ; i. s i g t o n , D . C . 20250 

Dear ?. alec Ira: 


in a letter to Dr. Jordan Baruch, former Assistant Seer 
: o v Product i vi ty , Technology and Innovation, Department of 


i u i 


Conroe r e ■; 


dated * November 1880, this Agency » s former Deputy 


D i r e c t o r f o r Adrr. i n i s t r a tion, ‘dr . 


( Don Wortman, requested that the 

Department delegate to the Director of Central Intel 1 igence (IkA ) 
independent authority to grant , for this Agency , xvaivers of the 
provisions of Federal In format ion Processing Standards x b I PS , 
promulgated by the Department. The letter set forth various 
security concerns which are raised by the current FIPS waiver 
p roeedures a n d e s p 1 a ined th e dele g at ion of procurement a u t n o v 1 1 y 
which, on account of similar concerns , the Agency has obtained 
from the General Services Administration. We have received no 
formal response to this request and because of the importance I 
attach to it, I would like to take this opportunity to reiterat* 
our concerns and the straightforv'ard 
•V ill alleviate th era . 


p r o e e d u r e 1 1 1 e t I b e 1 i e v e 


As you know, requests for waivers from FIPS, depending on 
tiie standard, either require coordination in advance with the 
Department, or your approval. In order to support a waiver 
request , extensive documentation is typically required by the 
Department . For example, one group of FIPS (FIPS . S0-G3 ) 
explicitly describe what must be included in a waiver request: 

" i) a description of the existing or planned ADP system for 
which the waiver is being requested, 2) a description of the 
system configuration, identifying those items for whs.cn toe. 
waiver is being requested, and including a description of. plans 
expansion of the system configuration at any t tme during it;-; 
cycle, and 3) a justification for the waiver , including » 
descrioti.cn and discussion of the major adverse economic or 


operational impact that would result through conformance 


t o 


n I s 


standard as comparer to the alternative 
requested . " 


o r vrh i e h the wa I v e r i 
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| this waiver request j rocedure Is cause for considerable 

security concern to senior CIA management. Under the statutory 
provisions of the Nations] Security Act of 1947, as amended, the 
DC I is charged with the responsibility for protecting 
intelligence sources and me thods . delating this to current end 
anticipated acquisitions of automatic data processing equipment 
(ADPfc) , it is our considered judgment that disclosure through 
the waiver process of the Agency’s capabilities and location of 
its resources would not only adversely affect the proper 
discharge of this responsibility hut would also, in sore 'leasee , 
represent a grave threat to national security. Our AjPPF , whether 
general purpose or unicue tc our requirements, is utilised for 
extremely sensitive intelligence information processing, 
communications, and reel-time in tel 1 igcnce— operation 
requirements. The type and location of equipment represent, for 
foreign intelligence agencies, prime targets in terms of 
operational utilization, equipment capabilities, or the 
readability of signal emanations. tf equal significance is the 
fact that, in certain instances, identification with the Agency 
of specific equipment or sites of operations could be extremely 
embarrassing to the united States or to friendly foreign 
qo vo rntsen ts . 

It is ray firm opinion that a delegation of independent f Ii>C 
waiver authority to the Director of Central Intelligence vitl 
appropriate redelegation authority would best protect the 
national security interests involved in the acquisition and use 
' of A CPF by the Central Intelligence Agency for intelligence 

information processing, communications and intelligence 
operational applications. I therefore request that the Secretary 
of Commerce delegate tc the PCI independent authority to grant, 
for this Agency, waivers of the previsions of Federal Information 
Processing Standards promulgated by the Department of Commerce. V 

Your favorable consideration of this request will be 
sincerely appreciated. I would be- pleased tc make available the 
appropriate members of my staff, to develop in conjunction with 
your representatives a suitable delegation of waiver authority. 

My Director of Data Processing, hr. Bruce T. Johnson, is 
available to a nswer any techn ical questions veu stay have, be can 
STAT be reached at [ 1 


tours , 

/s/. William X Csse"/ 

flVfc p | Oi on ■ William j. Casey 

E tf 
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